Revolut Exposes Bitcoin Data in Fake Gov Request

Revolut disclosed that it shared passports, identity documents and full Bitcoin transaction histories after receiving a fraudulent information request that appeared to come from a government agency’s own email domain. The company said the exposure affected a limited number of users, but the incident raises broader concerns about verification controls at financial platforms that handle both personal identification data and crypto activity records.

The case highlights a persistent weakness in operational security: attackers do not always need to breach systems directly if they can convince a firm to hand over sensitive data through a convincing request. For crypto users, the stakes are especially high because transaction histories can reveal wallet behavior, counterparties and financial exposure, while identity documents can be used for account takeover or downstream fraud.

The report arrives at a time when financial services firms are under growing pressure to balance regulatory compliance, customer data protection and rapid response procedures. It also reinforces the need for stronger authentication checks on law-enforcement and government requests, particularly when those requests involve documents tied to digital asset holdings.

Revolut has not indicated that customer funds were compromised. Still, the disclosure may prompt closer scrutiny from regulators and privacy advocates, especially if the fraudulent request exploited weaknesses in internal approval workflows rather than a technical breach.

For the crypto market, the direct price impact is likely limited. The larger significance lies in the reputational and regulatory burden on platforms that store both fiat-linked identity records and blockchain transaction data. That combination makes fintech and exchange providers attractive targets for impersonation schemes and increases the cost of compliance failures.